Privacy Policy

1. Information We Collect

When you create an account, we collect:

• First and last name
• Email address
• Country of residence
• Password (stored as a bcrypt hash; we never store plain text passwords)
• Login timestamps and login count

When you use the Service, we also collect:

• Project names and Figma file IDs
• JSON layout data exported from your Figma designs
• Subscription status and payment records (from Stripe). We never see or store your full card number.

2. How We Use Your Information

We use the information we collect to:

• Provide and operate the Service
• Authenticate your account and maintain your session
• Store and sync your Figma-to-Roblox project data
• Process payments and manage your subscription
• Send important account notifications (no marketing without consent)
• Improve the Service based on usage patterns

We record anonymous conversion stats (counts, timings and error codes) to improve Bloxig, never your design, unless you choose to share it.

To protect accounts we keep security logs (sign-in attempts, API key and plugin connection activity, and the IP address and device type of those requests) for 90 days, then they are deleted automatically.

3. Data Storage

Your data is stored on MongoDB Atlas (cloud database hosted by MongoDB Inc.) with servers located in the United States. Session data is also stored in MongoDB. We use Render.com to host the application server.

4. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We share data only with:

• Stripe (including Link): payments, tax and receipts, as merchant of record. Stripe handles your card details; we only receive your subscription status.
• MongoDB Atlas: database hosting
• Render.com: application hosting

These providers have their own privacy policies and we encourage you to review them.

5. Cookies

We use session cookies to keep you logged in. These are strictly necessary for the Service to function and do not track you across other websites. We do not use advertising or analytics cookies. Session cookies expire after 7 days of inactivity.

6. Your Rights

You have the right to:

• Access: request a copy of the data we hold about you
• Correction: update your account details via the profile page
• Deletion: request deletion of your account and all associated data
• Portability: request your project data in JSON format

To exercise these rights, contact us through the dashboard or GitHub.

7. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days. Project data (JSON layouts) may be retained in anonymized form for service improvement.

Screenshots you attach to a support ticket are only seen by Bloxig support and deleted after the ticket is closed (14 days after it is resolved; at the latest 60 days after upload).

8. Children's Privacy

Bloxig is a developer tool intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us immediately.

9. Security

We take security seriously. Passwords are hashed using bcrypt with salt rounds of 12. API access requires JWT authentication. Sessions are stored server-side in MongoDB with HTTP-only cookies. We use HTTPS in production via Render's SSL certificates.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a dashboard notice. The "last updated" date at the top of this page reflects the most recent revision.

11. Roblox Account Connection (Optional)

If you choose to connect your Roblox account ("Sign in with Roblox", under API keys), we store an encrypted Roblox access token, an encrypted Roblox refresh token, and your Roblox user ID. These are used only to upload your exported design images directly to your own Roblox account, never for any other purpose, and never shared with anyone but Roblox itself. You can disconnect your Roblox account at any time from Profile → Developer, which revokes Bloxig's access on Roblox's end and deletes the stored tokens.

12. Contact

For privacy-related questions or data deletion requests, please contact us through the dashboard or via our GitHub repository at github.com/ethruz/bloxig.